Implementation
GoHighLevel Audit Checklist: 75 Checks Before You Rebuild Anything
Most broken accounts do not need a rebuild. They need a diagnosis that distinguishes bad architecture from unfinished configuration.
1–8: ownership and recovery
Confirm the subscription owner, primary admin, recovery email, billing owner, domain registrar, DNS administrator, phone ownership, and integration-account ownership. Record any asset that depends on a former employee, contractor, reseller, or shared personal login.
9–16: users and permissions
List active users, inactive users, role assignments, location access, admin privileges, shared accounts, two-factor authentication, and the offboarding process. Compare access to job responsibility. Remove dormant privilege only through an approved change, not during discovery.
17–25: contacts and data model
Review duplicate rate, required fields, field definitions, tag taxonomy, smart lists, source values, consent records, import history, and deletion or retention rules. Sample records from every acquisition source. A clean average can hide a completely broken channel.
26–33: pipelines and opportunities
Check stage definitions, entry rules, exit rules, opportunity ownership, values, duplicate opportunities, stale records, lost reasons, and forecast reporting. Every stage should represent an observable buyer or delivery state rather than salesperson sentiment.
34–41: lead capture and calendars
Test forms, surveys, chat, inbound calls, missed calls, calendar availability, assignment, rescheduling, and cancellation. Verify mobile behavior, timezones, buffers, conflict calendars, notification recipients, and pipeline outcomes.
42–51: workflows and communication
Inventory published workflows, duplicate triggers, re-entry, goals, stops, suppression, quiet hours, opt-outs, internal alerts, and human escalation. Identify workflows with no owner, no test record, or no documented purpose.
52–59: deliverability and compliance
Verify A2P status, number assignment, opt-in evidence, sender identification, opt-out handling, email authentication, sending domains, bounce behavior, and complaint monitoring. Separate configuration status from actual delivery evidence.
60–66: integrations and reliability
List native integrations, webhooks, API credentials, Zapier or Make scenarios, retry behavior, error alerts, idempotency controls, and source-of-truth decisions. Trigger representative failures when safe. An integration without observable failure is an invisible queue of future data loss.
67–71: reporting and attribution
Compare dashboard definitions to business definitions. Validate source capture, opportunity values, status dates, revenue reconciliation, and date filters. Trace several real journeys from click or call through closed revenue.
72–75: adoption and governance
Confirm named system ownership, change approval, documentation, training, and review cadence. The technical score can be high while adoption remains low. Record what users bypass, export, duplicate, or track elsewhere and why.